Question

Are there any advantages in using Digest::SHA over Digest::SHA1 or vice versa? both seem to be maintained but I don’t see a reason for Digest::SHA1 to even exist with the existence of Digest::SHA.

Answer 1

There is none, Digest::SHA1 is legacy, as is SHA1. Per the docs of Digest::SHA1:

In 2005, security flaws were identified in SHA-1, namely that a possible mathematical weakness might exist, indicating that a stronger hash function would be desirable. The Digest::SHA module implements the stronger algorithms in the SHA family.

It clearly references Digest::SHA. The implementation in Digest::SHA is a bit faster than Digest::SHA1 (per the docs of Digest.pm — what you should probably be using anyway).

Algorithm      Size    Implementation                  MB/s
SHA-1          160     Digest::SHA v4.3.1              58.9
SHA-1          160     Digest::SHA1 v2.10              48.8

Digest is a factory for all modules in the Digest namespace, it prioritizes Digest::SHA over Digest::SHA1. You could even argue Digest::SHA1 is twice over deprecated, as it was replaced by Digest::SHA2.

I believe it probably useful to substantiate the term “deprecated” here. I simply mean that Digest::SHA1 isn’t useful for non-SHA1 hashes that are still in the SHA family — other distros can handle more.. Digest::SHA1 is also slower.. To the best of my knowledge it is still supported and has a stable release not all that long ago: Digest-SHA1-2.13 – 03 Jul 2010 – Gisle Aas